{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-b4337f0cc8a5c4db", "name": "Possibly dead Python function: list_contracts", "shortDescription": {"text": "Possibly dead Python function: list_contracts"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6b1fdb6aab5096c8", "name": "Possibly dead Python function: list_workloads", "shortDescription": {"text": "Possibly dead Python function: list_workloads"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-09518a465106ba87", "name": "Possibly dead Python function: contract_exists", "shortDescription": {"text": "Possibly dead Python function: contract_exists"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-86ca59d5b4599390", "name": "Possibly dead Python function: workload_exists", "shortDescription": {"text": "Possibly dead Python function: workload_exists"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7c3ecd0acf84c3cf", "name": "Possibly dead Python function: create_noop_ports_bundle", "shortDescription": {"text": "Possibly dead Python function: create_noop_ports_bundle"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-25705a7d1d2d26b0", "name": "Possibly dead Python function: send_message", "shortDescription": {"text": "Possibly dead Python function: send_message"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8d70abbd65b45e87", "name": "Possibly dead Python function: update_frontmatter", "shortDescription": {"text": "Possibly dead Python function: update_frontmatter"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-56ce76bbdd48ef1a", "name": "Possibly dead Python function: sort_key", "shortDescription": {"text": "Possibly dead Python function: sort_key"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d9808e68702a1676", "name": "Possibly dead Python function: squadops_health_check", "shortDescription": {"text": "Possibly dead Python function: squadops_health_check"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bc58cd8bfdfa77fd", "name": "Possibly dead Python function: decorator", "shortDescription": {"text": "Possibly dead Python function: decorator"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d52ba0f8ad76b919", "name": "Possibly dead Python function: set_health_auth_ports", "shortDescription": {"text": "Possibly dead Python function: set_health_auth_ports"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eabef5bef95c6127", "name": "Possibly dead Python function: replace_match", "shortDescription": {"text": "Possibly dead Python function: replace_match"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-82fcc7a7484eeec0", "name": "Possibly dead Python function: replace_match", "shortDescription": {"text": "Possibly dead Python function: replace_match"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9bc71d1bdb54d4f2", "name": "Dockerfile runs as root: agents/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: agents/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b18f6e12951fbc23", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-30e773d28408bc8a", "name": "Dockerfile runs as root: console/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: console/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c8c954d27b06f396", "name": "Docker base image uses a mutable or implicit tag: alpine/git:latest", "shortDescription": {"text": "Docker base image uses a mutable or implicit tag: alpine/git:latest"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7dec5d28cd029b63", "name": "Docker base image is tag-pinned but not digest-pinned: node:20-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b81df49d33cd3e78", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9c4a565ab4cc87f4", "name": "Dockerfile runs as root: src/squadops/api/runtime/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: src/squadops/api/runtime/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cc7ce709783a78cd", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0112efd235798121", "name": "Possible secret in tests/unit/telemetry/test_langfuse_adapter.py", "shortDescription": {"text": "Possible secret in tests/unit/telemetry/test_langfuse_adapter.py"}, "fullDescription": {"text": "Detected pattern matching openai_or_anthropic_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-bf2963cbcaa73e56", "name": "Possible secret in scripts/bootstrap/lib/langfuse_setup.sh", "shortDescription": {"text": "Possible secret in scripts/bootstrap/lib/langfuse_setup.sh"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-311816bd358ea143", "name": "Insecure pattern 'direct_innerhtml_assignment' in console/app/main.py:634", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in console/app/main.py:634"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e727fa7a5996043e", "name": "Insecure pattern 'subprocess_shell_true' in src/squadops/bootstrap/setup/checks.py:243", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in src/squadops/bootstrap/setup/checks.py:243"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-dd350f5f1068d3dd", "name": "Possible secret in config/profiles/dev.yaml", "shortDescription": {"text": "Possible secret in config/profiles/dev.yaml"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-160460eb21dbd109", "name": "Possible secret in config/profiles/lab.yaml", "shortDescription": {"text": "Possible secret in config/profiles/lab.yaml"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-0756d3027f43d4ed", "name": "Possible secret in config/profiles/local.yaml", "shortDescription": {"text": "Possible secret in config/profiles/local.yaml"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-9109c9f3446d2715", "name": "Possible secret in config/profiles/cloud.yaml", "shortDescription": {"text": "Possible secret in config/profiles/cloud.yaml"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-898d023de39b491b", "name": "Very large file: adapters/cycles/distributed_flow_executor.py (3172 lines)", "shortDescription": {"text": "Very large file: adapters/cycles/distributed_flow_executor.py (3172 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-479b0a0d9dd1210e", "name": "Very large file: tests/unit/cycles/test_correction_protocol.py (1423 lines)", "shortDescription": {"text": "Very large file: tests/unit/cycles/test_correction_protocol.py (1423 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-020fb87accb8409e", "name": "Very large file: tests/unit/cycles/test_distributed_flow_executor.py (3335 lines)", "shortDescription": {"text": "Very large file: tests/unit/cycles/test_distributed_flow_executor.py (3335 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cfc676d9f0c83646", "name": "Very large file: tests/unit/capabilities/test_planning_handlers.py (1355 lines)", "shortDescription": {"text": "Very large file: tests/unit/capabilities/test_planning_handlers.py (1355 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7ce42ec8a033509e", "name": "Very large file: src/squadops/capabilities/handlers/cycle_tasks.py (3226 lines)", "shortDescription": {"text": "Very large file: src/squadops/capabilities/handlers/cycle_tasks.py (3226 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0dfb3c95b98a1014", "name": "Very large file: src/squadops/capabilities/handlers/planning_tasks.py (1573 lines)", "shortDescription": {"text": "Very large file: src/squadops/capabilities/handlers/planning_tasks.py (1573 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 271 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 23 placeholder/mock markers across 10 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bea357a6497a2d5d", "name": "Agent authority lacks a verifier contract: CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-161602cac2b5cf7a", "name": "Agent authority lacks a verifier contract: .cursorrules", "shortDescription": {"text": "Agent authority lacks a verifier contract: .cursorrules"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-122f91b7f2906dc4", "name": "Agent authority lacks a verifier contract: .claude/settings.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8dbe21cac533364f", "name": "Commented-code block (5 lines) in adapters/cycles/distributed_flow_executor.py:171", "shortDescription": {"text": "Commented-code block (5 lines) in adapters/cycles/distributed_flow_executor.py:171"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ea0f422b19572e5a", "name": "Stub function `set_flow_run_state` (body is just `pass`/`return`) \u2014 adapters/cycles/noop_workflow_tracker.py:43", "shortDescription": {"text": "Stub function `set_flow_run_state` (body is just `pass`/`return`) \u2014 adapters/cycles/noop_workflow_tracker.py:43"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-93b1aa13ac6b63f2", "name": "Stub function `aclose` (body is just `pass`/`return`) \u2014 adapters/observability/log_forwarder/noop.py:16", "shortDescription": {"text": "Stub function `aclose` (body is just `pass`/`return`) \u2014 adapters/observability/log_forwarder/noop.py:16"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-524af60830ddae61", "name": "Legacy-named symbol `v0_legacy` in adapters/capabilities/aci_executor.py:14", "shortDescription": {"text": "Legacy-named symbol `v0_legacy` in adapters/capabilities/aci_executor.py:14"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5a7df08939098a81", "name": "Stub function `counter` (body is just `pass`/`return`) \u2014 adapters/noop/ports.py:160", "shortDescription": {"text": "Stub function `counter` (body is just `pass`/`return`) \u2014 adapters/noop/ports.py:160"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ac15c33bb1797900", "name": "Stub function `subscribe` (body is just `pass`/`return`) \u2014 adapters/events/noop_cycle_event_bus.py:27", "shortDescription": {"text": "Stub function `subscribe` (body is just `pass`/`return`) \u2014 adapters/events/noop_cycle_event_bus.py:27"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9d384697df0ebe8d", "name": "Stub function `start_cycle_trace` (body is just `pass`/`return`) \u2014 adapters/telemetry/noop_llm_observability.py:32", "shortDescription": {"text": "Stub function `start_cycle_trace` (body is just `pass`/`return`) \u2014 adapters/telemetry/noop_llm_observability.py:32"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2bfe6472a3fb008c", "name": "Legacy-named symbol `model_copy` in adapters/telemetry/factory.py:186", "shortDescription": {"text": "Legacy-named symbol `model_copy` in adapters/telemetry/factory.py:186"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-82f52e61a4c7139a", "name": "Commented-code block (5 lines) in tests/unit/cycles/test_postgres_cycle_registry.py:413", "shortDescription": {"text": "Commented-code block (5 lines) in tests/unit/cycles/test_postgres_cycle_registry.py:413"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bdd2950056c30a66", "name": "Legacy-named symbol `art_prd_v1` in tests/unit/cycles/conftest.py:61", "shortDescription": {"text": "Legacy-named symbol `art_prd_v1` in tests/unit/cycles/conftest.py:61"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-acc497987c413f31", "name": "Commented-code block (6 lines) in tests/unit/cycles/test_acceptance_checks.py:470", "shortDescription": {"text": "Commented-code block (6 lines) in tests/unit/cycles/test_acceptance_checks.py:470"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ad4842e53436d1dc", "name": "Legacy-named symbol `art_prd_v1` in tests/unit/cycles/test_models.py:152", "shortDescription": {"text": "Legacy-named symbol `art_prd_v1` in tests/unit/cycles/test_models.py:152"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c2721f3524761108", "name": "Commented-code block (6 lines) in tests/unit/cycles/test_flow_executor.py:291", "shortDescription": {"text": "Commented-code block (6 lines) in tests/unit/cycles/test_flow_executor.py:291"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-708aa381a64f0041", "name": "Legacy-named symbol `test_missing_task_index_falls_back_to_legacy` in tests/unit/cycles/test_distributed_flow_executor.p", "shortDescription": {"text": "Legacy-named symbol `test_missing_task_index_falls_back_to_legacy` in tests/unit/cycles/test_distributed_flow_executor.py:449"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-00098af4d5e1978e", "name": "Commented-code block (5 lines) in tests/unit/cycles/test_distributed_flow_executor.py:1444", "shortDescription": {"text": "Commented-code block (5 lines) in tests/unit/cycles/test_distributed_flow_executor.py:1444"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-950d7702153bc5a7", "name": "Legacy-named symbol `hash_legacy` in tests/unit/cycles/test_legacy_parity.py:78", "shortDescription": {"text": "Legacy-named symbol `hash_legacy` in tests/unit/cycles/test_legacy_parity.py:78"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6f3f35ae98336fe4", "name": "Legacy-named symbol `default_v1` in tests/unit/cli/test_commands_cycles.py:46", "shortDescription": {"text": "Legacy-named symbol `default_v1` in tests/unit/cli/test_commands_cycles.py:46"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-92572f2f507b806a", "name": "Commented-code block (5 lines) in tests/unit/capabilities/test_impl_handlers.py:60", "shortDescription": {"text": "Commented-code block (5 lines) in tests/unit/capabilities/test_impl_handlers.py:60"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-28fbc84c8325e788", "name": "Commented-code block (7 lines) in tests/unit/capabilities/test_planning_handlers.py:124", "shortDescription": {"text": "Commented-code block (7 lines) in tests/unit/capabilities/test_planning_handlers.py:124"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a1ad54869311c752", "name": "Commented-code block (5 lines) in tests/unit/capabilities/handlers/test_typed_acceptance_validation.py:505", "shortDescription": {"text": "Commented-code block (5 lines) in tests/unit/capabilities/handlers/test_typed_acceptance_validation.py:505"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-80c044d2e49d8420", "name": "Commented-code block (5 lines) in src/squadops/cycles/plan_delta.py:32", "shortDescription": {"text": "Commented-code block (5 lines) in src/squadops/cycles/plan_delta.py:32"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b384d96bc4b35e95", "name": "Commented-code block (5 lines) in src/squadops/cycles/task_plan.py:58", "shortDescription": {"text": "Commented-code block (5 lines) in src/squadops/cycles/task_plan.py:58"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1d6518bd2595da98", "name": "Commented-code block (5 lines) in src/squadops/agents/entrypoint.py:690", "shortDescription": {"text": "Commented-code block (5 lines) in src/squadops/agents/entrypoint.py:690"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fc9e01cea66bb442", "name": "Commented-code block (6 lines) in src/squadops/agents/skills/qa/test_execution.py:79", "shortDescription": {"text": "Commented-code block (6 lines) in src/squadops/agents/skills/qa/test_execution.py:79"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cff5c868e453e746", "name": "Commented-code block (12 lines) in src/squadops/llm/model_registry.py:41", "shortDescription": {"text": "Commented-code block (12 lines) in src/squadops/llm/model_registry.py:41"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a4b19859c2d8cfe5", "name": "Legacy-named symbol `_v0_legacy` in src/squadops/api/runtime/__init__.py:4", "shortDescription": {"text": "Legacy-named symbol `_v0_legacy` in src/squadops/api/runtime/__init__.py:4"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-004904416199adf7", "name": "Legacy-named symbol `_v0_legacy` in src/squadops/api/runtime/main.py:5", "shortDescription": {"text": "Legacy-named symbol `_v0_legacy` in src/squadops/api/runtime/main.py:5"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d077272384a45e16", "name": "Legacy-named symbol `_v0_legacy` in src/squadops/api/runtime/deps.py:4", "shortDescription": {"text": "Legacy-named symbol `_v0_legacy` in src/squadops/api/runtime/deps.py:4"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b674ff11d8be8ada", "name": "Legacy-named symbol `_v0_legacy` in src/squadops/core/lineage.py:7", "shortDescription": {"text": "Legacy-named symbol `_v0_legacy` in src/squadops/core/lineage.py:7"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fb6c1de086713634", "name": "Legacy-named symbol `_v0_legacy` in src/squadops/tasks/types.py:11", "shortDescription": {"text": "Legacy-named symbol `_v0_legacy` in src/squadops/tasks/types.py:11"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4d24055648894c50", "name": "Legacy-named symbol `_v0_legacy` in src/squadops/tasks/legacy_models.py:5", "shortDescription": {"text": "Legacy-named symbol `_v0_legacy` in src/squadops/tasks/legacy_models.py:5"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bfa84379c2a723b8", "name": "Network/subprocess call without timeout or try/except \u2014 src/squadops/cli/commands/bootstrap.py:65", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 src/squadops/cli/commands/bootstrap.py:65"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ded9c4c77c9230e1", "name": "Commented-code block (5 lines) in src/squadops/capabilities/handlers/_plan_authoring_service.py:188", "shortDescription": {"text": "Commented-code block (5 lines) in src/squadops/capabilities/handlers/_plan_authoring_service.py:188"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-039e4249283c7551", "name": "Commented-code block (9 lines) in src/squadops/capabilities/handlers/cycle_tasks.py:124", "shortDescription": {"text": "Commented-code block (9 lines) in src/squadops/capabilities/handlers/cycle_tasks.py:124"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1dda14f701e0bd13", "name": "Commented-code block (8 lines) in src/squadops/capabilities/handlers/planning_tasks.py:424", "shortDescription": {"text": "Commented-code block (8 lines) in src/squadops/capabilities/handlers/planning_tasks.py:424"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9dea2ae98c840c97", "name": "Commented-code block (6 lines) in src/squadops/capabilities/handlers/fenced_parser.py:33", "shortDescription": {"text": "Commented-code block (6 lines) in src/squadops/capabilities/handlers/fenced_parser.py:33"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-029f0ed4b28501c8", "name": "Commented-code block (5 lines) in src/squadops/capabilities/handlers/_plan_merger.py:121", "shortDescription": {"text": "Commented-code block (5 lines) in src/squadops/capabilities/handlers/_plan_merger.py:121"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4e83f45eb0562d5f", "name": "Commented-code block (8 lines) in src/squadops/capabilities/handlers/impl/analyze_failure.py:111", "shortDescription": {"text": "Commented-code block (8 lines) in src/squadops/capabilities/handlers/impl/analyze_failure.py:111"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-aa8e2eacc85b3423", "name": "Commented-code block (6 lines) in src/squadops/capabilities/handlers/impl/establish_contract.py:62", "shortDescription": {"text": "Commented-code block (6 lines) in src/squadops/capabilities/handlers/impl/establish_contract.py:62"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-685d7e31e3b8b1e5", "name": "Commented-code block (7 lines) in src/squadops/capabilities/handlers/impl/correction_decision.py:33", "shortDescription": {"text": "Commented-code block (7 lines) in src/squadops/capabilities/handlers/impl/correction_decision.py:33"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1662ae7a5bb4e048", "name": "33 env vars used in code but missing from .env.example", "shortDescription": {"text": "33 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `CONSOLE_CLIENT_ID`, `CONSOLE_REDIRECT_URI`, `DEPLOYMENT_PROFILE`, `HEALTH_CHECK_PUBLIC_URL`, `HEARTBEAT_INTERVAL`, `KEYCLOAK_PUBLIC_URL`, `KEYCLOAK_URL`, `LANGFUSE_API_PUBLIC_URL` + 25 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nadapters/cycles/postgres_squad_profile.py:update_profile, adapters/cycles/config_squad_profile.py:update_profile, src/squadops/ports/cycles/squad_profile.py:update_profile\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nadapters/cycles/filesystem_artifact_vault.py:retrieve, adapters/cycles/filesystem_artifact_vault.py:promote_artifact\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-380b7cb95b387b9c", "name": "Near-duplicate function bodies in 11 places", "shortDescription": {"text": "Near-duplicate function bodies in 11 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nadapters/llm/ollama.py:chat, adapters/llm/ollama.py:chat_stream_with_usage, adapters/llm/ollama.py:chat_stream, adapters/noop/ports.py:chat\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-28d121f0c178bdc2", "name": "FastAPI POST `proxy_chat_stream` without auth dependency \u2014 console/app/main.py:435", "shortDescription": {"text": "FastAPI POST `proxy_chat_stream` without auth dependency \u2014 console/app/main.py:435"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5c8468bdefb92053", "name": "FastAPI POST `refresh` without auth dependency \u2014 console/app/auth_bff.py:262", "shortDescription": {"text": "FastAPI POST `refresh` without auth dependency \u2014 console/app/auth_bff.py:262"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0da06737b446ecd8", "name": "FastAPI POST `create_or_update_agent_status` without auth dependency \u2014 src/squadops/api/routes/platform_health.py:143", "shortDescription": {"text": "FastAPI POST `create_or_update_agent_status` without auth dependency \u2014 src/squadops/api/routes/platform_health.py:143"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b829f3e11097d8c1", "name": "FastAPI PUT `update_agent_status` without auth dependency \u2014 src/squadops/api/routes/platform_health.py:175", "shortDescription": {"text": "FastAPI PUT `update_agent_status` without auth dependency \u2014 src/squadops/api/routes/platform_health.py:175"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2c8ef13645d1cb6d", "name": "FastAPI POST `set_active_profile` without auth dependency \u2014 src/squadops/api/routes/cycles/profiles.py:121", "shortDescription": {"text": "FastAPI POST `set_active_profile` without auth dependency \u2014 src/squadops/api/routes/cycles/profiles.py:121"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9648f82b322f93cb", "name": "FastAPI POST `create_profile` without auth dependency \u2014 src/squadops/api/routes/cycles/profiles.py:133", "shortDescription": {"text": "FastAPI POST `create_profile` without auth dependency \u2014 src/squadops/api/routes/cycles/profiles.py:133"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ce2f98d344745a3d", "name": "FastAPI PUT `update_profile` without auth dependency \u2014 src/squadops/api/routes/cycles/profiles.py:158", "shortDescription": {"text": "FastAPI PUT `update_profile` without auth dependency \u2014 src/squadops/api/routes/cycles/profiles.py:158"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-df186ef03b26b595", "name": "FastAPI POST `clone_profile` without auth dependency \u2014 src/squadops/api/routes/cycles/profiles.py:185", "shortDescription": {"text": "FastAPI POST `clone_profile` without auth dependency \u2014 src/squadops/api/routes/cycles/profiles.py:185"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-93b8b25ae1eca100", "name": "FastAPI DELETE `delete_profile` without auth dependency \u2014 src/squadops/api/routes/cycles/profiles.py:208", "shortDescription": {"text": "FastAPI DELETE `delete_profile` without auth dependency \u2014 src/squadops/api/routes/cycles/profiles.py:208"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3a48177f52343e0f", "name": "FastAPI POST `activate_profile` without auth dependency \u2014 src/squadops/api/routes/cycles/profiles.py:220", "shortDescription": {"text": "FastAPI POST `activate_profile` without auth dependency \u2014 src/squadops/api/routes/cycles/profiles.py:220"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-aec596c67184402c", "name": "FastAPI POST `create_run` without auth dependency \u2014 src/squadops/api/routes/cycles/runs.py:35", "shortDescription": {"text": "FastAPI POST `create_run` without auth dependency \u2014 src/squadops/api/routes/cycles/runs.py:35"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-acab4f3af126e78b", "name": "FastAPI POST `cancel_run` without auth dependency \u2014 src/squadops/api/routes/cycles/runs.py:109", "shortDescription": {"text": "FastAPI POST `cancel_run` without auth dependency \u2014 src/squadops/api/routes/cycles/runs.py:109"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-910b4819eb6bd247", "name": "FastAPI POST `gate_decision` without auth dependency \u2014 src/squadops/api/routes/cycles/runs.py:121", "shortDescription": {"text": "FastAPI POST `gate_decision` without auth dependency \u2014 src/squadops/api/routes/cycles/runs.py:121"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f44ede62359c3ba8", "name": "FastAPI POST `resume_run` without auth dependency \u2014 src/squadops/api/routes/cycles/runs.py:175", "shortDescription": {"text": "FastAPI POST `resume_run` without auth dependency \u2014 src/squadops/api/routes/cycles/runs.py:175"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ba0182ac9c88fdde", "name": "FastAPI POST `pull_model` without auth dependency \u2014 src/squadops/api/routes/cycles/models.py:113", "shortDescription": {"text": "FastAPI POST `pull_model` without auth dependency \u2014 src/squadops/api/routes/cycles/models.py:113"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6a30d4519bcced01", "name": "FastAPI DELETE `delete_model` without auth dependency \u2014 src/squadops/api/routes/cycles/models.py:158", "shortDescription": {"text": "FastAPI DELETE `delete_model` without auth dependency \u2014 src/squadops/api/routes/cycles/models.py:158"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-25a608dcf18610c1", "name": "FastAPI POST `ingest_artifact` without auth dependency \u2014 src/squadops/api/routes/cycles/artifacts.py:31", "shortDescription": {"text": "FastAPI POST `ingest_artifact` without auth dependency \u2014 src/squadops/api/routes/cycles/artifacts.py:31"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-601c82b764846caf", "name": "FastAPI POST `promote_artifact` without auth dependency \u2014 src/squadops/api/routes/cycles/artifacts.py:125", "shortDescription": {"text": "FastAPI POST `promote_artifact` without auth dependency \u2014 src/squadops/api/routes/cycles/artifacts.py:125"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-161f24173450261e", "name": "FastAPI POST `promote_baseline` without auth dependency \u2014 src/squadops/api/routes/cycles/artifacts.py:232", "shortDescription": {"text": "FastAPI POST `promote_baseline` without auth dependency \u2014 src/squadops/api/routes/cycles/artifacts.py:232"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-322825239e2c53fa", "name": "FastAPI POST `create_cycle` without auth dependency \u2014 src/squadops/api/routes/cycles/cycles.py:26", "shortDescription": {"text": "FastAPI POST `create_cycle` without auth dependency \u2014 src/squadops/api/routes/cycles/cycles.py:26"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d2d296772157d3ea", "name": "FastAPI POST `cancel_cycle` without auth dependency \u2014 src/squadops/api/routes/cycles/cycles.py:176", "shortDescription": {"text": "FastAPI POST `cancel_cycle` without auth dependency \u2014 src/squadops/api/routes/cycles/cycles.py:176"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-83f48f1315c62fa9", "name": "FastAPI POST `send_chat_message` without auth dependency \u2014 src/squadops/api/routes/chat/routes.py:98", "shortDescription": {"text": "FastAPI POST `send_chat_message` without auth dependency \u2014 src/squadops/api/routes/chat/routes.py:98"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24454"}, "properties": {"repository": "backspring-labs/squad-ops", "repoUrl": "https://github.com/backspring-labs/squad-ops", "branch": "main"}, "results": [{"ruleId": "scanner-b4337f0cc8a5c4db", "level": "note", "message": {"text": "Possibly dead Python function: list_contracts"}, "properties": {"repobilityId": "3977c5dc25968a8b", "scanner": "scanner-primary", "fingerprint": "b4337f0cc8a5c4db", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adapters/capabilities/filesystem.py:289"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6b1fdb6aab5096c8", "level": "note", "message": {"text": "Possibly dead Python function: list_workloads"}, "properties": {"repobilityId": "55201b33f8dfcc61", "scanner": "scanner-primary", "fingerprint": "6b1fdb6aab5096c8", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adapters/capabilities/filesystem.py:317"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-09518a465106ba87", "level": "note", "message": {"text": "Possibly dead Python function: contract_exists"}, "properties": {"repobilityId": "b3f1838293286c37", "scanner": "scanner-primary", "fingerprint": "09518a465106ba87", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adapters/capabilities/filesystem.py:335"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-86ca59d5b4599390", "level": "note", "message": {"text": "Possibly dead Python function: workload_exists"}, "properties": {"repobilityId": "324248a822c9eb62", "scanner": "scanner-primary", "fingerprint": "86ca59d5b4599390", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adapters/capabilities/filesystem.py:339"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7c3ecd0acf84c3cf", "level": "note", "message": {"text": "Possibly dead Python function: create_noop_ports_bundle"}, "properties": {"repobilityId": "3ee5dc22fddd9727", "scanner": "scanner-primary", "fingerprint": "7c3ecd0acf84c3cf", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adapters/noop/ports.py:217"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-25705a7d1d2d26b0", "level": "note", "message": {"text": "Possibly dead Python function: send_message"}, "properties": {"repobilityId": "1249251570e4ca4d", "scanner": "scanner-primary", "fingerprint": "25705a7d1d2d26b0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adapters/comms/a2a_client.py:60"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8d70abbd65b45e87", "level": "note", "message": {"text": "Possibly dead Python function: update_frontmatter"}, "properties": {"repobilityId": "5eda2b8929220d9a", "scanner": "scanner-primary", "fingerprint": "8d70abbd65b45e87", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/maintainer/update_sip_status.py:102"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-56ce76bbdd48ef1a", "level": "note", "message": {"text": "Possibly dead Python function: sort_key"}, "properties": {"repobilityId": "ac2a4181eae38738", "scanner": "scanner-primary", "fingerprint": "56ce76bbdd48ef1a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/maintainer/update_sip_status.py:518"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d9808e68702a1676", "level": "note", "message": {"text": "Possibly dead Python function: squadops_health_check"}, "properties": {"repobilityId": "f6ab42899eec5793", "scanner": "scanner-primary", "fingerprint": "d9808e68702a1676", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "console/app/main.py:111"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bc58cd8bfdfa77fd", "level": "note", "message": {"text": "Possibly dead Python function: decorator"}, "properties": {"repobilityId": "ffbcbc9bc189af1c", "scanner": "scanner-primary", "fingerprint": "bc58cd8bfdfa77fd", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/squadops/cycles/acceptance_checks.py:237"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d52ba0f8ad76b919", "level": "note", "message": {"text": "Possibly dead Python function: set_health_auth_ports"}, "properties": {"repobilityId": "45fa00c1dfdf2d3d", "scanner": "scanner-primary", "fingerprint": "d52ba0f8ad76b919", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/squadops/api/health_deps.py:14"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-eabef5bef95c6127", "level": "note", "message": {"text": "Possibly dead Python function: replace_match"}, "properties": {"repobilityId": "2a03a347407fff24", "scanner": "scanner-primary", "fingerprint": "eabef5bef95c6127", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/squadops/core/secrets.py:178"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-82fcc7a7484eeec0", "level": "note", "message": {"text": "Possibly dead Python function: replace_match"}, "properties": {"repobilityId": "2a03a347407fff24", "scanner": "scanner-primary", "fingerprint": "82fcc7a7484eeec0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/squadops/capabilities/acceptance.py:110"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9bc71d1bdb54d4f2", "level": "warning", "message": {"text": "Dockerfile runs as root: agents/Dockerfile"}, "properties": {"repobilityId": "9df00b4c308c5b7f", "scanner": "scanner-primary", "fingerprint": "9bc71d1bdb54d4f2", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-b18f6e12951fbc23", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "ba7ac2950ac767cc", "scanner": "scanner-primary", "fingerprint": "b18f6e12951fbc23", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agents/Dockerfile"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-b18f6e12951fbc23", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "4a6e829cb08cfcb1", "scanner": "scanner-primary", "fingerprint": "b18f6e12951fbc23", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agents/Dockerfile"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-30e773d28408bc8a", "level": "warning", "message": {"text": "Dockerfile runs as root: console/Dockerfile"}, "properties": {"repobilityId": "b499a3863f1cd2e5", "scanner": "scanner-primary", "fingerprint": "30e773d28408bc8a", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-c8c954d27b06f396", "level": "warning", "message": {"text": "Docker base image uses a mutable or implicit tag: alpine/git:latest"}, "properties": {"repobilityId": "4a26b34622be24bc", "scanner": "scanner-primary", "fingerprint": "c8c954d27b06f396", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "console/Dockerfile"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-7dec5d28cd029b63", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-slim"}, "properties": {"repobilityId": "9828932096cd4e73", "scanner": "scanner-primary", "fingerprint": "7dec5d28cd029b63", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "console/Dockerfile"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-7dec5d28cd029b63", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-slim"}, "properties": {"repobilityId": "1cee9339669067dd", "scanner": "scanner-primary", "fingerprint": "7dec5d28cd029b63", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "console/Dockerfile"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-b81df49d33cd3e78", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "a95c62cd9c8d370f", "scanner": "scanner-primary", "fingerprint": "b81df49d33cd3e78", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "console/Dockerfile"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-9c4a565ab4cc87f4", "level": "warning", "message": {"text": "Dockerfile runs as root: src/squadops/api/runtime/Dockerfile"}, "properties": {"repobilityId": "742b88de8033fb80", "scanner": "scanner-primary", "fingerprint": "9c4a565ab4cc87f4", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-cc7ce709783a78cd", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "70a7f9f697108594", "scanner": "scanner-primary", "fingerprint": "cc7ce709783a78cd", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/squadops/api/runtime/Dockerfile"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-cc7ce709783a78cd", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "990243c355123c45", "scanner": "scanner-primary", "fingerprint": "cc7ce709783a78cd", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/squadops/api/runtime/Dockerfile"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-0112efd235798121", "level": "error", "message": {"text": "Possible secret in tests/unit/telemetry/test_langfuse_adapter.py"}, "properties": {"repobilityId": "02de3b5fe3d923b6", "scanner": "scanner-primary", "fingerprint": "0112efd235798121", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/unit/telemetry/test_langfuse_adapter.py"}, "region": {"startLine": 227}}}]}, {"ruleId": "scanner-0112efd235798121", "level": "error", "message": {"text": "Possible secret in tests/unit/telemetry/test_langfuse_adapter.py"}, "properties": {"repobilityId": "02de3b5fe3d923b6", "scanner": "scanner-primary", "fingerprint": "0112efd235798121", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/unit/telemetry/test_langfuse_adapter.py"}, "region": {"startLine": 234}}}]}, {"ruleId": "scanner-bf2963cbcaa73e56", "level": "error", "message": {"text": "Possible secret in scripts/bootstrap/lib/langfuse_setup.sh"}, "properties": {"repobilityId": "1631f11422e44fcf", "scanner": "scanner-primary", "fingerprint": "bf2963cbcaa73e56", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/bootstrap/lib/langfuse_setup.sh"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-311816bd358ea143", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in console/app/main.py:634"}, "properties": {"repobilityId": "8997ed785a04ab34", "scanner": "scanner-primary", "fingerprint": "311816bd358ea143", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "console/app/main.py"}, "region": {"startLine": 634}}}]}, {"ruleId": "scanner-e727fa7a5996043e", "level": "error", "message": {"text": "Insecure pattern 'subprocess_shell_true' in src/squadops/bootstrap/setup/checks.py:243"}, "properties": {"repobilityId": "59df14dcffacbefe", "scanner": "scanner-primary", "fingerprint": "e727fa7a5996043e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/squadops/bootstrap/setup/checks.py"}, "region": {"startLine": 243}}}]}, {"ruleId": "scanner-dd350f5f1068d3dd", "level": "error", "message": {"text": "Possible secret in config/profiles/dev.yaml"}, "properties": {"repobilityId": "b809d9d27d062210", "scanner": "scanner-primary", "fingerprint": "dd350f5f1068d3dd", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "config/profiles/dev.yaml"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-160460eb21dbd109", "level": "error", "message": {"text": "Possible secret in config/profiles/lab.yaml"}, "properties": {"repobilityId": "f87d0008542323a6", "scanner": "scanner-primary", "fingerprint": "160460eb21dbd109", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "config/profiles/lab.yaml"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-0756d3027f43d4ed", "level": "error", "message": {"text": "Possible secret in config/profiles/local.yaml"}, "properties": {"repobilityId": "5dceaace88ca64de", "scanner": "scanner-primary", "fingerprint": "0756d3027f43d4ed", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "config/profiles/local.yaml"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-9109c9f3446d2715", "level": "error", "message": {"text": "Possible secret in config/profiles/cloud.yaml"}, "properties": {"repobilityId": "cf47048c41215f70", "scanner": "scanner-primary", "fingerprint": "9109c9f3446d2715", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "config/profiles/cloud.yaml"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-898d023de39b491b", "level": "note", "message": {"text": "Very large file: adapters/cycles/distributed_flow_executor.py (3172 lines)"}, "properties": {"repobilityId": "863c73f0d337ba82", "scanner": "scanner-primary", "fingerprint": "898d023de39b491b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-479b0a0d9dd1210e", "level": "note", "message": {"text": "Very large file: tests/unit/cycles/test_correction_protocol.py (1423 lines)"}, "properties": {"repobilityId": "3a5ea8ef7ac0eb44", "scanner": "scanner-primary", "fingerprint": "479b0a0d9dd1210e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-020fb87accb8409e", "level": "note", "message": {"text": "Very large file: tests/unit/cycles/test_distributed_flow_executor.py (3335 lines)"}, "properties": {"repobilityId": "bd5dc1fe833d1cb8", "scanner": "scanner-primary", "fingerprint": "020fb87accb8409e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-cfc676d9f0c83646", "level": "note", "message": {"text": "Very large file: tests/unit/capabilities/test_planning_handlers.py (1355 lines)"}, "properties": {"repobilityId": "acbf7098c1b2a0bd", "scanner": "scanner-primary", "fingerprint": "cfc676d9f0c83646", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7ce42ec8a033509e", "level": "note", "message": {"text": "Very large file: src/squadops/capabilities/handlers/cycle_tasks.py (3226 lines)"}, "properties": {"repobilityId": "bd54a91217b16db3", "scanner": "scanner-primary", "fingerprint": "7ce42ec8a033509e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0dfb3c95b98a1014", "level": "note", "message": {"text": "Very large file: src/squadops/capabilities/handlers/planning_tasks.py (1573 lines)"}, "properties": {"repobilityId": "db1f39a85b34054f", "scanner": "scanner-primary", "fingerprint": "0dfb3c95b98a1014", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "c0a7406d44937315", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "bbdd290858994f63", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "f59be9d2d44122cd", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "9535e4b7c3d3d50e", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-bea357a6497a2d5d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "properties": {"repobilityId": "aae72df3934829ac", "scanner": "scanner-primary", "fingerprint": "bea357a6497a2d5d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-161602cac2b5cf7a", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .cursorrules"}, "properties": {"repobilityId": "2c319532e2ded78d", "scanner": "scanner-primary", "fingerprint": "161602cac2b5cf7a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "cursor_rule"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".cursorrules"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-122f91b7f2906dc4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "properties": {"repobilityId": "a2967269048b6a9d", "scanner": "scanner-primary", "fingerprint": "122f91b7f2906dc4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/settings.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8dbe21cac533364f", "level": "none", "message": {"text": "Commented-code block (5 lines) in adapters/cycles/distributed_flow_executor.py:171"}, "properties": {"repobilityId": "6162f9776d6247b5", "scanner": "scanner-primary", "fingerprint": "8dbe21cac533364f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ea0f422b19572e5a", "level": "note", "message": {"text": "Stub function `set_flow_run_state` (body is just `pass`/`return`) \u2014 adapters/cycles/noop_workflow_tracker.py:43"}, "properties": {"repobilityId": "16b8ee2c703698a6", "scanner": "scanner-primary", "fingerprint": "ea0f422b19572e5a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-93b1aa13ac6b63f2", "level": "note", "message": {"text": "Stub function `aclose` (body is just `pass`/`return`) \u2014 adapters/observability/log_forwarder/noop.py:16"}, "properties": {"repobilityId": "052ffb50d09ed761", "scanner": "scanner-primary", "fingerprint": "93b1aa13ac6b63f2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-524af60830ddae61", "level": "note", "message": {"text": "Legacy-named symbol `v0_legacy` in adapters/capabilities/aci_executor.py:14"}, "properties": {"repobilityId": "64e986132f9198bc", "scanner": "scanner-primary", "fingerprint": "524af60830ddae61", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-5a7df08939098a81", "level": "note", "message": {"text": "Stub function `counter` (body is just `pass`/`return`) \u2014 adapters/noop/ports.py:160"}, "properties": {"repobilityId": "f7717d7f14b46ef9", "scanner": "scanner-primary", "fingerprint": "5a7df08939098a81", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-ac15c33bb1797900", "level": "note", "message": {"text": "Stub function `subscribe` (body is just `pass`/`return`) \u2014 adapters/events/noop_cycle_event_bus.py:27"}, "properties": {"repobilityId": "115b344897b5587f", "scanner": "scanner-primary", "fingerprint": "ac15c33bb1797900", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-9d384697df0ebe8d", "level": "note", "message": {"text": "Stub function `start_cycle_trace` (body is just `pass`/`return`) \u2014 adapters/telemetry/noop_llm_observability.py:32"}, "properties": {"repobilityId": "36b25978e52ab42f", "scanner": "scanner-primary", "fingerprint": "9d384697df0ebe8d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-2bfe6472a3fb008c", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in adapters/telemetry/factory.py:186"}, "properties": {"repobilityId": "fcd621c9e7c9cd35", "scanner": "scanner-primary", "fingerprint": "2bfe6472a3fb008c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-82f52e61a4c7139a", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/unit/cycles/test_postgres_cycle_registry.py:413"}, "properties": {"repobilityId": "3a288b4228a75206", "scanner": "scanner-primary", "fingerprint": "82f52e61a4c7139a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bdd2950056c30a66", "level": "note", "message": {"text": "Legacy-named symbol `art_prd_v1` in tests/unit/cycles/conftest.py:61"}, "properties": {"repobilityId": "fc136f868da5103c", "scanner": "scanner-primary", "fingerprint": "bdd2950056c30a66", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-acc497987c413f31", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/unit/cycles/test_acceptance_checks.py:470"}, "properties": {"repobilityId": "2645c38aeb332d38", "scanner": "scanner-primary", "fingerprint": "acc497987c413f31", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ad4842e53436d1dc", "level": "note", "message": {"text": "Legacy-named symbol `art_prd_v1` in tests/unit/cycles/test_models.py:152"}, "properties": {"repobilityId": "b03616fea6ed008f", "scanner": "scanner-primary", "fingerprint": "ad4842e53436d1dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c2721f3524761108", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/unit/cycles/test_flow_executor.py:291"}, "properties": {"repobilityId": "8d22ca75d1ee6302", "scanner": "scanner-primary", "fingerprint": "c2721f3524761108", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-708aa381a64f0041", "level": "note", "message": {"text": "Legacy-named symbol `test_missing_task_index_falls_back_to_legacy` in tests/unit/cycles/test_distributed_flow_executor.py:449"}, "properties": {"repobilityId": "908355d7e0341c1e", "scanner": "scanner-primary", "fingerprint": "708aa381a64f0041", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-00098af4d5e1978e", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/unit/cycles/test_distributed_flow_executor.py:1444"}, "properties": {"repobilityId": "03cd119dd5773dfd", "scanner": "scanner-primary", "fingerprint": "00098af4d5e1978e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-950d7702153bc5a7", "level": "note", "message": {"text": "Legacy-named symbol `hash_legacy` in tests/unit/cycles/test_legacy_parity.py:78"}, "properties": {"repobilityId": "844d76a7d19ff8bc", "scanner": "scanner-primary", "fingerprint": "950d7702153bc5a7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-6f3f35ae98336fe4", "level": "note", "message": {"text": "Legacy-named symbol `default_v1` in tests/unit/cli/test_commands_cycles.py:46"}, "properties": {"repobilityId": "c27f21dc10116fca", "scanner": "scanner-primary", "fingerprint": "6f3f35ae98336fe4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-92572f2f507b806a", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/unit/capabilities/test_impl_handlers.py:60"}, "properties": {"repobilityId": "823296561f35cae4", "scanner": "scanner-primary", "fingerprint": "92572f2f507b806a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-28fbc84c8325e788", "level": "none", "message": {"text": "Commented-code block (7 lines) in tests/unit/capabilities/test_planning_handlers.py:124"}, "properties": {"repobilityId": "879fc61655476c5e", "scanner": "scanner-primary", "fingerprint": "28fbc84c8325e788", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a1ad54869311c752", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/unit/capabilities/handlers/test_typed_acceptance_validation.py:505"}, "properties": {"repobilityId": "034a1f7ccfc1f714", "scanner": "scanner-primary", "fingerprint": "a1ad54869311c752", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-80c044d2e49d8420", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/squadops/cycles/plan_delta.py:32"}, "properties": {"repobilityId": "d0adc7484b876473", "scanner": "scanner-primary", "fingerprint": "80c044d2e49d8420", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b384d96bc4b35e95", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/squadops/cycles/task_plan.py:58"}, "properties": {"repobilityId": "2231018e954c3ecf", "scanner": "scanner-primary", "fingerprint": "b384d96bc4b35e95", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1d6518bd2595da98", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/squadops/agents/entrypoint.py:690"}, "properties": {"repobilityId": "befb7602412f9899", "scanner": "scanner-primary", "fingerprint": "1d6518bd2595da98", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fc9e01cea66bb442", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/squadops/agents/skills/qa/test_execution.py:79"}, "properties": {"repobilityId": "07656cb4e8328aa7", "scanner": "scanner-primary", "fingerprint": "fc9e01cea66bb442", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cff5c868e453e746", "level": "none", "message": {"text": "Commented-code block (12 lines) in src/squadops/llm/model_registry.py:41"}, "properties": {"repobilityId": "eb07ff7a181d3a55", "scanner": "scanner-primary", "fingerprint": "cff5c868e453e746", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a4b19859c2d8cfe5", "level": "note", "message": {"text": "Legacy-named symbol `_v0_legacy` in src/squadops/api/runtime/__init__.py:4"}, "properties": {"repobilityId": "20d1e5102a5eeef7", "scanner": "scanner-primary", "fingerprint": "a4b19859c2d8cfe5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-004904416199adf7", "level": "note", "message": {"text": "Legacy-named symbol `_v0_legacy` in src/squadops/api/runtime/main.py:5"}, "properties": {"repobilityId": "0749db29138aef09", "scanner": "scanner-primary", "fingerprint": "004904416199adf7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d077272384a45e16", "level": "note", "message": {"text": "Legacy-named symbol `_v0_legacy` in src/squadops/api/runtime/deps.py:4"}, "properties": {"repobilityId": "654b19b20ffad487", "scanner": "scanner-primary", "fingerprint": "d077272384a45e16", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b674ff11d8be8ada", "level": "note", "message": {"text": "Legacy-named symbol `_v0_legacy` in src/squadops/core/lineage.py:7"}, "properties": {"repobilityId": "963ab97298a35ced", "scanner": "scanner-primary", "fingerprint": "b674ff11d8be8ada", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-fb6c1de086713634", "level": "note", "message": {"text": "Legacy-named symbol `_v0_legacy` in src/squadops/tasks/types.py:11"}, "properties": {"repobilityId": "fd80a68ef9cc749c", "scanner": "scanner-primary", "fingerprint": "fb6c1de086713634", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-4d24055648894c50", "level": "note", "message": {"text": "Legacy-named symbol `_v0_legacy` in src/squadops/tasks/legacy_models.py:5"}, "properties": {"repobilityId": "b10f1cadcb6426d0", "scanner": "scanner-primary", "fingerprint": "4d24055648894c50", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-bfa84379c2a723b8", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 src/squadops/cli/commands/bootstrap.py:65"}, "properties": {"repobilityId": "10fb03e8567bd258", "scanner": "scanner-primary", "fingerprint": "bfa84379c2a723b8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-ded9c4c77c9230e1", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/squadops/capabilities/handlers/_plan_authoring_service.py:188"}, "properties": {"repobilityId": "a09318dbc5b2cc83", "scanner": "scanner-primary", "fingerprint": "ded9c4c77c9230e1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-039e4249283c7551", "level": "none", "message": {"text": "Commented-code block (9 lines) in src/squadops/capabilities/handlers/cycle_tasks.py:124"}, "properties": {"repobilityId": "c80847ece1a5022f", "scanner": "scanner-primary", "fingerprint": "039e4249283c7551", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1dda14f701e0bd13", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/squadops/capabilities/handlers/planning_tasks.py:424"}, "properties": {"repobilityId": "baa702e93adb9fd3", "scanner": "scanner-primary", "fingerprint": "1dda14f701e0bd13", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9dea2ae98c840c97", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/squadops/capabilities/handlers/fenced_parser.py:33"}, "properties": {"repobilityId": "3f0cd637044da02c", "scanner": "scanner-primary", "fingerprint": "9dea2ae98c840c97", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-029f0ed4b28501c8", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/squadops/capabilities/handlers/_plan_merger.py:121"}, "properties": {"repobilityId": "51adf1d6355fff6f", "scanner": "scanner-primary", "fingerprint": "029f0ed4b28501c8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4e83f45eb0562d5f", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/squadops/capabilities/handlers/impl/analyze_failure.py:111"}, "properties": {"repobilityId": "6d5c82a6419096cf", "scanner": "scanner-primary", "fingerprint": "4e83f45eb0562d5f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-aa8e2eacc85b3423", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/squadops/capabilities/handlers/impl/establish_contract.py:62"}, "properties": {"repobilityId": "d45626cacfcbc15b", "scanner": "scanner-primary", "fingerprint": "aa8e2eacc85b3423", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-685d7e31e3b8b1e5", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/squadops/capabilities/handlers/impl/correction_decision.py:33"}, "properties": {"repobilityId": "83d3ad15f8ff358a", "scanner": "scanner-primary", "fingerprint": "685d7e31e3b8b1e5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1662ae7a5bb4e048", "level": "note", "message": {"text": "33 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "90293c220e284644", "scanner": "scanner-primary", "fingerprint": "1662ae7a5bb4e048", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "d1f0ccde9037b9ac", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "82700a408742d6e3", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "63b15ee041d03b0e", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "08d70e843a4f838d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "c5d0eb5b5bea2c93", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "fa0d3aae09d62d6d", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "fbb87b45353ce1a2", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "1c86334bfc744881", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "2a5afccd22b9798c", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "6e5ec0449db4fbd2", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ee6e0672f7028356", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-380b7cb95b387b9c", "level": "note", "message": {"text": "Near-duplicate function bodies in 11 places"}, "properties": {"repobilityId": "c30c35c0278b3385", "scanner": "scanner-primary", "fingerprint": "380b7cb95b387b9c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "e7152828936d4c99", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "a7dccdb5d392ddf6", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "22703f4751e97cf6", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "26e8881b03bce7aa", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "22a1ea022ca0b7a3", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "355883e20b8a0d7f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "99171351bb16a5ff", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "6e9872ea74546fbf", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-28d121f0c178bdc2", "level": "error", "message": {"text": "FastAPI POST `proxy_chat_stream` without auth dependency \u2014 console/app/main.py:435"}, "properties": {"repobilityId": "101a727d19d82bef", "scanner": "scanner-primary", "fingerprint": "28d121f0c178bdc2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "console/app/main.py"}, "region": {"startLine": 435}}}]}, {"ruleId": "scanner-5c8468bdefb92053", "level": "error", "message": {"text": "FastAPI POST `refresh` without auth dependency \u2014 console/app/auth_bff.py:262"}, "properties": {"repobilityId": "0f2682f1bec2ee43", "scanner": "scanner-primary", "fingerprint": "5c8468bdefb92053", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "console/app/auth_bff.py"}, "region": {"startLine": 262}}}]}, {"ruleId": "scanner-0da06737b446ecd8", "level": "error", "message": {"text": "FastAPI POST `create_or_update_agent_status` without auth dependency \u2014 src/squadops/api/routes/platform_health.py:143"}, "properties": {"repobilityId": "3938bb91d6f551e9", "scanner": "scanner-primary", "fingerprint": "0da06737b446ecd8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/squadops/api/routes/platform_health.py"}, "region": {"startLine": 143}}}]}, {"ruleId": "scanner-b829f3e11097d8c1", "level": "error", "message": {"text": "FastAPI PUT `update_agent_status` without auth dependency \u2014 src/squadops/api/routes/platform_health.py:175"}, "properties": {"repobilityId": "4b6f38235b659e08", "scanner": "scanner-primary", "fingerprint": "b829f3e11097d8c1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/squadops/api/routes/platform_health.py"}, "region": {"startLine": 175}}}]}, {"ruleId": "scanner-2c8ef13645d1cb6d", "level": "error", "message": {"text": "FastAPI POST `set_active_profile` without auth dependency \u2014 src/squadops/api/routes/cycles/profiles.py:121"}, "properties": {"repobilityId": "df434f6ff9723356", "scanner": "scanner-primary", "fingerprint": "2c8ef13645d1cb6d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/squadops/api/routes/cycles/profiles.py"}, "region": {"startLine": 121}}}]}, {"ruleId": "scanner-9648f82b322f93cb", "level": "error", "message": {"text": "FastAPI POST `create_profile` without auth dependency \u2014 src/squadops/api/routes/cycles/profiles.py:133"}, "properties": {"repobilityId": "0445013054cf294a", "scanner": "scanner-primary", "fingerprint": "9648f82b322f93cb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/squadops/api/routes/cycles/profiles.py"}, "region": {"startLine": 133}}}]}, {"ruleId": "scanner-ce2f98d344745a3d", "level": "error", "message": {"text": "FastAPI PUT `update_profile` without auth dependency \u2014 src/squadops/api/routes/cycles/profiles.py:158"}, "properties": {"repobilityId": "4f9be0fb5d18f414", "scanner": "scanner-primary", "fingerprint": "ce2f98d344745a3d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/squadops/api/routes/cycles/profiles.py"}, "region": {"startLine": 158}}}]}, {"ruleId": "scanner-df186ef03b26b595", "level": "error", "message": {"text": "FastAPI POST `clone_profile` without auth dependency \u2014 src/squadops/api/routes/cycles/profiles.py:185"}, "properties": {"repobilityId": "308f66b96e9644b6", "scanner": "scanner-primary", "fingerprint": "df186ef03b26b595", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/squadops/api/routes/cycles/profiles.py"}, "region": {"startLine": 185}}}]}, {"ruleId": "scanner-93b8b25ae1eca100", "level": "error", "message": {"text": "FastAPI DELETE `delete_profile` without auth dependency \u2014 src/squadops/api/routes/cycles/profiles.py:208"}, "properties": {"repobilityId": "ca01f379ba994975", "scanner": "scanner-primary", "fingerprint": "93b8b25ae1eca100", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/squadops/api/routes/cycles/profiles.py"}, "region": {"startLine": 208}}}]}, {"ruleId": "scanner-3a48177f52343e0f", "level": "error", "message": {"text": "FastAPI POST `activate_profile` without auth dependency \u2014 src/squadops/api/routes/cycles/profiles.py:220"}, "properties": {"repobilityId": "33646cc99057347c", "scanner": "scanner-primary", "fingerprint": "3a48177f52343e0f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/squadops/api/routes/cycles/profiles.py"}, "region": {"startLine": 220}}}]}, {"ruleId": "scanner-aec596c67184402c", "level": "error", "message": {"text": "FastAPI POST `create_run` without auth dependency \u2014 src/squadops/api/routes/cycles/runs.py:35"}, "properties": {"repobilityId": "e62b47823b24f935", "scanner": "scanner-primary", "fingerprint": "aec596c67184402c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/squadops/api/routes/cycles/runs.py"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-acab4f3af126e78b", "level": "error", "message": {"text": "FastAPI POST `cancel_run` without auth dependency \u2014 src/squadops/api/routes/cycles/runs.py:109"}, "properties": {"repobilityId": "de0b50554995c852", "scanner": "scanner-primary", "fingerprint": "acab4f3af126e78b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/squadops/api/routes/cycles/runs.py"}, "region": {"startLine": 109}}}]}, {"ruleId": "scanner-910b4819eb6bd247", "level": "error", "message": {"text": "FastAPI POST `gate_decision` without auth dependency \u2014 src/squadops/api/routes/cycles/runs.py:121"}, "properties": {"repobilityId": "5a878adb3e7728cb", "scanner": "scanner-primary", "fingerprint": "910b4819eb6bd247", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/squadops/api/routes/cycles/runs.py"}, "region": {"startLine": 121}}}]}, {"ruleId": "scanner-f44ede62359c3ba8", "level": "error", "message": {"text": "FastAPI POST `resume_run` without auth dependency \u2014 src/squadops/api/routes/cycles/runs.py:175"}, "properties": {"repobilityId": "247111f56f579b8b", "scanner": "scanner-primary", "fingerprint": "f44ede62359c3ba8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/squadops/api/routes/cycles/runs.py"}, "region": {"startLine": 175}}}]}, {"ruleId": "scanner-ba0182ac9c88fdde", "level": "error", "message": {"text": "FastAPI POST `pull_model` without auth dependency \u2014 src/squadops/api/routes/cycles/models.py:113"}, "properties": {"repobilityId": "f6ea0ef2855e502c", "scanner": "scanner-primary", "fingerprint": "ba0182ac9c88fdde", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/squadops/api/routes/cycles/models.py"}, "region": {"startLine": 113}}}]}, {"ruleId": "scanner-6a30d4519bcced01", "level": "error", "message": {"text": "FastAPI DELETE `delete_model` without auth dependency \u2014 src/squadops/api/routes/cycles/models.py:158"}, "properties": {"repobilityId": "a1fd9b9f61db762a", "scanner": "scanner-primary", "fingerprint": "6a30d4519bcced01", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/squadops/api/routes/cycles/models.py"}, "region": {"startLine": 158}}}]}, {"ruleId": "scanner-25a608dcf18610c1", "level": "error", "message": {"text": "FastAPI POST `ingest_artifact` without auth dependency \u2014 src/squadops/api/routes/cycles/artifacts.py:31"}, "properties": {"repobilityId": "a026169c9d638242", "scanner": "scanner-primary", "fingerprint": "25a608dcf18610c1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/squadops/api/routes/cycles/artifacts.py"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-601c82b764846caf", "level": "error", "message": {"text": "FastAPI POST `promote_artifact` without auth dependency \u2014 src/squadops/api/routes/cycles/artifacts.py:125"}, "properties": {"repobilityId": "3b5c8bb7cebf5240", "scanner": "scanner-primary", "fingerprint": "601c82b764846caf", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/squadops/api/routes/cycles/artifacts.py"}, "region": {"startLine": 125}}}]}, {"ruleId": "scanner-161f24173450261e", "level": "error", "message": {"text": "FastAPI POST `promote_baseline` without auth dependency \u2014 src/squadops/api/routes/cycles/artifacts.py:232"}, "properties": {"repobilityId": "95de15931042cec2", "scanner": "scanner-primary", "fingerprint": "161f24173450261e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/squadops/api/routes/cycles/artifacts.py"}, "region": {"startLine": 232}}}]}, {"ruleId": "scanner-322825239e2c53fa", "level": "error", "message": {"text": "FastAPI POST `create_cycle` without auth dependency \u2014 src/squadops/api/routes/cycles/cycles.py:26"}, "properties": {"repobilityId": "54ebe14c838574a6", "scanner": "scanner-primary", "fingerprint": "322825239e2c53fa", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/squadops/api/routes/cycles/cycles.py"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-d2d296772157d3ea", "level": "error", "message": {"text": "FastAPI POST `cancel_cycle` without auth dependency \u2014 src/squadops/api/routes/cycles/cycles.py:176"}, "properties": {"repobilityId": "e5b361bc29a76f34", "scanner": "scanner-primary", "fingerprint": "d2d296772157d3ea", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/squadops/api/routes/cycles/cycles.py"}, "region": {"startLine": 176}}}]}, {"ruleId": "scanner-83f48f1315c62fa9", "level": "error", "message": {"text": "FastAPI POST `send_chat_message` without auth dependency \u2014 src/squadops/api/routes/chat/routes.py:98"}, "properties": {"repobilityId": "e24c035870e263df", "scanner": "scanner-primary", "fingerprint": "83f48f1315c62fa9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/squadops/api/routes/chat/routes.py"}, "region": {"startLine": 98}}}]}]}]}